The Right to Privacy in India
Total Page:16
File Type:pdf, Size:1020Kb
Stateholder Report Universal Periodic 27th Session: The Right to Privacy in India Stakeholder Report Universal Periodic Review 27th Session – India The Right to Privacy in India Submitted by Centre for Internet and Society India and Privacy International October 2016 1 Stateholder Report Universal Periodic 27th Session: The Right to Privacy in India Submitted by Centre for Internet and Society India and Privacy International October 2016 Stateholder Report Universal Periodic 27th Session: The Right to Privacy in India Introduction 1. This stakeholder report is a submission by Centre for Internet and Society India (CIS India) and Privacy International (PI). CIS is a non-profit organisation that undertakes interdisciplinary research on internet and digital technologies from policy and academic perspectives. Through its diverse initiatives, CIS explores, intervenes in, and advances contemporary discourse and practices around internet, technology and society in India, and elsewhere. PI is a human rights organisation that works to advance and promote the right to privacy and fight surveillance around the world. 2. CIS and PI wish to bring concerns about the protection and promotion of the right to privacy in India before the Human Rights Council for consideration in India’s upcoming review. The right to privacy 3. Privacy is a fundamental human right, enshrined in numerous international human rights instruments.1 It is central to the protection of human dignity and forms the basis of any democratic society. It also supports and reinforces other rights, such as freedom of expression, information and association. 4. Activities that restrict the right to privacy, such as surveillance and censorship, can only be justified when they are prescribed by law, necessary to achieve a legitimate aim, and proportionate to the aim pursued.2 5. As innovations in information technology have enabled previously unimagined forms of collecting, storing and sharing personal data, the right to privacy has evolved to encapsulate State obligations related to the protection of personal data.3 A number of international instruments enshrine data protection principles,4 and many domestic legislatures have incorporated such principles into national law.5 1 Universal Declaration of Human Rights Article 12, United Nations Convention on Migrant Workers Article 14, UN Convention of the Protection of the Child Article 16, International Covenant on Civil and Political Rights, International Covenant on Civil and Political Rights Article 17; regional conventions including Article 10 of the African Charter on the Rights and Welfare of the Child, Article 11 of the American Convention on Human Rights, Article 4 of the African Union Principles on Freedom of Expression, Article 5 of the American Declaration of the Rights and Duties of Man, Article 21 of the Arab Charter on Human Rights, and Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms; Johannesburg Principles on National Security, Free Expression and Access to Information, Camden Principles on Freedom of Expression and Equality. 2 Universal Declaration of Human Rights Article 29; General Comment No. 27, Adopted by The Human Rights Committee Under Article 40, Paragraph 4, Of The International Covenant On Civil and Political Rights, CCPR/C/21/Rev.1/Add.9, November 2, 1999; See also Martin Scheinin, “Report of the Special Rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism,” 2009, A/ HRC/17/34. 3 Human Rights Committee general comment No. 16 (1988) on the right to respect of privacy, family, home and correspondence, and protection of honour and reputation (art. 17) See: A/HRC/WG.6/13/MAR/3, para. 37 4 See the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (No. 108), 1981; the Organization for Economic Co-operation and Development Guidelines on the Protection of Privacy and Transborder Data Flows of Personal Data (1980); and the Guidelines for the regulation of computerized personal data files (General Assembly resolution 45/95 and E/CN.4/1990/72) 5 As of December 2013, 101 countries had enacted data protection legislation. See: David Banisar, National Comprehensive Data Protection/Privacy Laws and Bills 2014 Map (January 28, 2014). Available at SSRN:http://ssrn.com/abstract=1951416 or http://dx.doi.org/10.2139/ssrn.1951416 3 Stateholder Report Universal Periodic 27th Session: The Right to Privacy in India 6. Privacy also has implication for the freedom of opinion and expression. The Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression emphasises that the “right to privacy is often understood as an essential requirement for the realization of the right to freedom of expression. Undue interference with individual’s privacy can both directly and indirectly limit the free development and exchange of ideas.”6 Follow up to the previous UPR 7. There was no mention of the right to privacy within the context of communication surveillance and data protection in the National Report submitted by India. 8. The right to privacy was not raised as an issue of concern either by UN Members States nor external stakeholders. Domestic laws related to privacy 9. The Constitution of India does not specifically guarantee a right to privacy, however through various judgements over the years the Courts of the country have interpreted the other rights in the Constitution to be giving rise to a (limited) right to privacy – primarily through Article 21 – the right to life and liberty. In 2015, this interpretation was challenged and referred to a larger Bench of the Supreme Court (the highest Court in the country) in the writ petition Justice K.S Puttaswamy & Another vs. Union of India and Others, the case is currently pending in the Supreme Court. 10. The constitutional right to privacy in India is subject to a number of restrictions. These restrictions have been culled out through the interpretation of various provisions and judgements of the Supreme Court of India: • The right to privacy can be restricted by procedure established by law which procedure would have to be just, fair and reasonable (Maneka Gandhi v. Union of India); • Reasonable restrictions can be imposed on the right to privacy in the interests of the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, public order, decency or morality, or in relation to contempt of court, defamation or incitement to an offence; (Article 19(2) of the Constitution of India, 1950) • The right to privacy can be restricted if there is an important countervailing interest which is superior (Gobind v. State of M.P.); 6 A/HRC/23/40 4 Stateholder Report Universal Periodic 27th Session: The Right to Privacy in India • The right to privacy can be restricted if there is a compelling state interest to be served (Gobind v. State of M.P.); • The protection available under the right to privacy may not be available to a person who voluntarily thrusts her/himself into controversy (R. Rajagopal v. Union of India). • Like most fundamental rights in the Indian Constitution, the right to privacy has been mostly interpreted as a vertical right applicable only against the State, as defined under Article 12 of the Constitution, and not against private citizens. (Zoroastrian Cooperative Housing Society v District Registrar) 11. India does not have a comprehensive privacy legislation and limited data protection standards can be found under section 43A and associated Rules in the Information Technology Act 2000. International obligations 12. India has ratified the International Covenant on Civil and Political Rights (‘ICCPR’). Article 17 of the ICCPR provides that “no one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation”. The Human Rights Committee has noted that states party to the ICCPR have a positive obligation to “adopt legislative and other measures to give effect to the prohibition against such interferences and attacks as well as to the protection of this right [privacy].”7 Areas of concern I. Communications surveillance Broad and fragmented standards for surveillance 13. Communication surveillance in India is primarily regulated by two different statutes, the Telegraph Act, 1885 (“Telegraph Act”) (which deals with interception of calls) and the Information Technology Act, 2000 (“IT Act”) (which deals with interception of electronic data). 14. Before 1996, the state authorities relied upon the provisions of the Telegraph Act to carry out interception of phone calls. The Act allows any authorized public official to intercept communications on the occurrence of any public emergency or in the interest of public safety.8 Communications can be intercepted under the Telegraph Act during “public emergencies” or 7 General Comment No. 16 (1988), para. 1 8 Section 5(2) of the Indian Telegraph Act, 1885 5 Stateholder Report Universal Periodic 27th Session: The Right to Privacy in India in the interest of “public safety” provided that such interception is in the interests of certain other grounds, namely, the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, public order and for preventing the incitement of offences. Such broad and vague justifications for surveillance have become a feature of many jurisdictions. The concept of national integrity or security are usually defined very broadly and are vulnerable to misuse as a means to target certain kinds of actors and propagate unnecessary secrecy around law enforcement measures, thus, having an adverse impact on transparency and accountability.9 15. However, in 1996 the Supreme Court noticed the lack of procedural safeguards in the provisions of the Telegraph Act and laid down certain guidelines for interceptions. These guidelines formed the basis of the Rules defining the procedures of interception that were codified by introducing Rule 419A in the Telegraph Rules in 2007.